Document Mail.Send mailbox scoping

Author: ezaero

README.md

@@ -92,11 +92,54 @@ The repository includes a GitHub Actions workflow for Azure Static Web Apps. Pus
 
 Required deployment values should be stored as Azure Static Web Apps application settings or GitHub environment secrets, not in source control.
 
+## Mail.Send Scoping
+
+Microsoft Graph `Mail.Send` application permission is tenant-wide by default: without additional Exchange Online controls, an app with this permission may be able to send as any mailbox in the tenant.
+
+Production deployments should restrict the app to the configured sender mailbox with an Exchange Online application access policy:
+
+```powershell
+Connect-ExchangeOnline -UserPrincipalName admin@example.org
+
+$appId = "<graph-client-id>"
+$senderMailbox = "sender@example.org"
+$scopeAddress = "capresponseform-mailsend-scope@example.org"
+
+New-DistributionGroup `
+  -Name "CAPResponseForm Mail.Send Scope" `
+  -Alias "CAPResponseForm-MailSend-Scope" `
+  -Type Security `
+  -PrimarySmtpAddress $scopeAddress
+
+Add-DistributionGroupMember `
+  -Identity $scopeAddress `
+  -Member $senderMailbox `
+  -BypassSecurityGroupManagerCheck
+
+New-ApplicationAccessPolicy `
+  -AppId $appId `
+  -PolicyScopeGroupId $scopeAddress `
+  -AccessRight RestrictAccess `
+  -Description "Restrict CAPResponseForm Mail.Send to the configured sender mailbox."
+```
+
+Verify the effective scope with `Test-ApplicationAccessPolicy`:
+
+```powershell
+Test-ApplicationAccessPolicy -AppId $appId -Identity $senderMailbox
+Test-ApplicationAccessPolicy -AppId $appId -Identity someone-else@example.org
+```
+
+Expected results:
+
+- The configured sender mailbox returns `Granted`.
+- A mailbox outside the scope group returns `Denied`.
+
 ## Security Notes
 
 - Do not commit `api/local.settings.json`.
 - Do not commit Graph client secrets, Turnstile secret keys, deployment tokens, or mailbox credentials.
-- Restrict the Microsoft Graph mail application to the smallest practical mailbox scope.
+- Restrict the Microsoft Graph mail application to the smallest practical mailbox scope with an Exchange Online application access policy.
 - Use email override settings for testing in non-production environments.
 - Review public examples and tests before adding real personal addresses or tenant-specific values.